MalwareFinancial ServicesFinanceRansomwareData ExfiltratedTargetedIdentity (basic)Government IDHighContained

First Financial Security

bd_aff224a399f38bef · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 17, 2023

Filed

Jan 3, 2024

To disclose

11 weeks

Affected

2,328state residents only

Linked

13 filings

Confidence

69%

Full breach record for First Financial Security →

First Financial Security, Inc. reported a ransomware attack on October 17, 2023, affecting 2,328 Washington residents. The attack attempted to freeze systems but was unsuccessful in disrupting operations. A limited amount of data, including names, personal information, and Social Security numbers, was exposed. FFS engaged forensic experts, enhanced security, and offered 12 months of identity theft protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d11 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 11 weeks / 78 days

Oct 17, 2023

Begins

Oct 17, 2023

Discovered

Jan 3, 2024

Filed

vs. sector median

+3 wks slower

This filing is one of 13 about the same incident.View merged incident

A leak claim by ransomhouse about this victim predates this filing by 76 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

California State AGbd_4d924f83378dd3732024-01-19 · +16dVerified
Maine State AGbd_07e779fa3c454dd32024-01-22 · +19dVerified
California State AGbd_3cce2402d8d3ade92024-01-22 · +19dVerified
New Hampshire State AGbd_be68a4e3fb13fb6a2024-01-22 · +19dVerified

Show 6 more filings ↓up to 30d gap

Massachusetts State AGbd_26bec3675d7747c02024-01-23 · +20dVerified by operator
South Carolina State AGbd_376c075094fa399a2024-01-23 · +20dVerified
Oregon State AGbd_d5e7a15eb37ead792024-01-23 · +20dVerified
Montana State AGbd_e247aee4a995db932024-01-23 · +20dVerified
New Hampshire State AGbd_fdcfb106d48342b82024-02-01 · +29dVerified
Massachusetts State AGbd_dc6f4463bca2e3692024-02-02 · +30dVerified by operator

Showing first 10 of 12 linked disclosures.

Name: Marshall, Dennehey, Warner, Coleman & Bobo, P.A.
norm: marshall dennehey warner coleman bobo
Domain: firstfinancialsecurity.com

Name: First Financial Security
norm: first financial security
Domain: firstfinancialsecurity.com
Industry: Financial Servicesllm

Discovered: Oct 17, 2023
Breach occurred: Oct 17, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 19, 2024
Affected individuals: 2,328state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Office of the Attorney General

During the incident: Conducted an investigation to understand what had taken place and how
Reviewed and enhanced the security of its systems
Provided resources to consumers to help protect against potential misuse of personal information
Offered identity theft protection services through IDX
Provided 12 months of credit and CyberScan monitoring
Provided a $1,000,000 insurance reimbursement policy
Provided fully managed id theft recovery services
Changes made: Reviewed and enhanced the security of its systems
Continues to monitor systems for further signs of activity or compromises
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(78 days from discovery to filing)
Compliance flags: WA AG >30dLeak >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 8 states

View merged incident ↗

Washington State AGJan 3 · first · this page

California State AG+16d

Maine State AG+19d

California State AG+19d

New Hampshire State AG+19d

Massachusetts State AG+20d

South Carolina State AG+20d

Oregon State AG+20d

Montana State AG+20d

New Hampshire State AG+29d

Massachusetts State AG+30d

Pattern: first filing Jan 3 (WA), last Feb 2 (MA) — a 30-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 12 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM16327.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 3, 2024
Raw hash: 02660b8746ed09ca95f4173d683f4e65ba95c51e01476338dc5762291afa877b

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityMarshall, Dennehey, Warner, Coleman & Bobo, P.A.

Victim entityFirst Financial Security

Incidentdiscovered Oct 17, 2023

Stated responseConducted an investigation to understand what had taken place and how

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com